zeek-x509-spki

By 0xxon

This package adds the Subject Public Key Info (SPKI) or each x509 certificate to x509.log. It can span multiple lines, with this indentation.

zeek-xdp

By zeek

XDP traffic shunter

zeek-xor-exe-plugin

By corelight

A plugin to find Windows executables that have been XOR encoded.

zeekctl-systemd

By awelzel

A Zeekctl plugin that hooks install and start to run Zeek using systemd

zeekjs

By corelight

Experimental JavaScript support for Zeek.

zeekjs-misp

By awelzel

zeekjs-notice-slack

By pgaulon

Package extending the Notice Framework to include to send Notices via Slack webhooks.

zeekjs-notice-telegram

By corelight

Package that extends the Notice Framework to include `ACTION_TELEGRAM` for sending messages on notices over Telegram using ZeekJS.

zeekjs-redis

By mbispham

A zkg package that uses ZeekJS to overwrite the Logging Framework to output Zeek logs to Redis. Each log id type is associated with a unique key. For example, conn.log should be stored in the key zeek_conn_logs.

zeekjs-udp-logging

By awelzel

JavaScript based logging via UDP

zerologon

By corelight

Detects Zerologon (CVE-2020-1472) attempts and exploits.

ztest

By corelight

A Zeek Unit Testing Framework